Add oauth 2.1 check by mooreds · Pull Request #37 · FusionAuth/fusionauth-node-cli

mooreds · 2026-03-27T17:22:07Z

This checks against the OAuth 2.1 recommendations for a given FusionAuth installation.

Copilot

Pull request overview

Adds a new CLI command to assess a FusionAuth instance against key OAuth 2.1 (draft-ietf-oauth-v2-1-15) recommendations, with both human-readable and JSON output modes.

Changes:

Introduces check:oauth-2-1 command to validate tenant-, instance-, and application-level settings relevant to OAuth 2.1 guidance.
Updates documentation to describe the new command, its options, and what is checked.
Upgrades @fusionauth/typescript-client to support the new checks and updates lockfile accordingly.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/commands/index.ts	Exports the new `check:oauth-2-1` command for auto-registration by the CLI.
src/commands/check-oauth-2-1.ts	Implements the OAuth 2.1 compliance checking logic and output formatting.
package.json	Bumps `@fusionauth/typescript-client` dependency version/range.
package-lock.json	Updates lockfile for new dependency versions and bumps package version.
README.md	Documents the new OAuth 2.1 compliance command and its behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-07T03:24:26Z

+        if (tenantId) {
+            tenants = tenants.filter(t => t.id === tenantId);
+            if (tenants.length === 0) {
+                errorAndExit(`Tenant with ID "${tenantId}" not found.`);
+                return;
+            }


When both --tenant-id and --application-id are provided, the code filters the tenants list but then retrieves and checks the application by ID without validating it belongs to the selected tenant. This can produce a mixed result set (tenant-level checks for one tenant, app-level checks for another). Consider either rejecting the combination as invalid or validating app.tenantId === tenantId and erroring if it doesn’t match.

Copilot · 2026-04-07T03:24:26Z

+- Tenant issuer properly configured — not default "acme.com"
+
+**WARNINGS (informational, does not cause exit 1):**
+- DPoP (sender-constrained tokens) enabled on applications (§1.4.3)


The README states “DPoP … enabled on applications”, but the implementation treats DPoP as an instance-level capability with no per-application toggle (and only checks license/reactor status). Consider rewording this bullet to reflect what the command actually validates (e.g., DPoP availability/Enterprise licensing) to avoid implying an application-level setting exists.

Suggested change

- DPoP (sender-constrained tokens) enabled on applications (§1.4.3)

- DPoP (sender-constrained tokens) available on the FusionAuth instance / Enterprise-enabled (§1.4.3)

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-07T22:19:16Z

+        // Tenants
+        const tenantResponse = await client.retrieveTenants();
+        if (!tenantResponse.wasSuccessful() || !tenantResponse.response.tenants) {
+            errorAndExit('Failed to retrieve tenants.');
+            return;
+        }
+
+        let tenants = tenantResponse.response.tenants;
+        if (tenantId) {


When --application-id is provided without --tenant-id, tenants remains the full tenant list and the tenant-level checks (issuer / refresh token revocation / auth code lifetime) will run against all tenants. This can cause the command to fail due to unrelated tenant settings, even though the user asked to check a single application. Consider narrowing tenants to the application's tenantId when applicationId is set (or skipping tenant-level checks not applicable to the app scope).

Copilot · 2026-04-07T22:19:17Z

+
+        // -- Instance-level checks -------------------------------------------
+
+        const dpopResult = checkDpop(dpopFeatureActive ?? false);


dpopFeatureActive has a tri-state (true/false/unknown) but the check currently coerces undefined to false via dpopFeatureActive ?? false, which reports DPoP as unavailable even when the status couldn't be determined (and JSON output has no way to represent the unknown state). Consider propagating an explicit unknown state into the result/output (e.g., passed: null or a distinct message) instead of treating unknown as unavailable.

Suggested change

const dpopResult = checkDpop(dpopFeatureActive ?? false);

const dpopResult = checkDpop(dpopFeatureActive);

Copilot · 2026-04-07T22:19:17Z

-    return response.wasSuccessful !== undefined;
+export const isClientResponse = (response: any): response is ClientResponseLike => {
+    return response !== null
+        && typeof response === 'object'


isClientResponse narrows to ClientResponseLike which requires a response property, but the runtime check only verifies wasSuccessful is a function. This makes the type guard unsound (it can return true for objects without response). Consider also checking that a response key exists (and optionally that it's an object) before returning true.

Suggested change

&& typeof response === 'object'

&& typeof response === 'object'

&& 'response' in response

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…usionauth-node-cli into mooreds/add-oauth-2-1-check

mooreds added 8 commits March 27, 2026 10:53

added oauth 2.1 check

b4b7ff6

added readme for oauth 2.1 check

706534a

upgrade typescript client version to grab new features

ce233bd

accurate handling of dpop

7b6a8ca

upgrade typescript client version to grab new features

3412438

fixing audit warnings

07ef7f3

Merge branch 'main' into mooreds/add-oauth-2-1-check

476aa70

updated to 1.64 for realz

b2fe23c

mooreds requested a review from Copilot March 27, 2026 23:31

Copilot started reviewing on behalf of mooreds March 27, 2026 23:31 View session

Copilot AI reviewed Mar 27, 2026

View reviewed changes

Comment thread src/commands/check-oauth-2-1.ts Outdated

Comment thread README.md Outdated

Comment thread package.json

mooreds added 3 commits April 6, 2026 21:09

handle single application better

0ddd263

remove internal import

baea395

more doco

d07520a

mooreds requested a review from Copilot April 7, 2026 03:21

Copilot started reviewing on behalf of mooreds April 7, 2026 03:22 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

mooreds and others added 2 commits April 7, 2026 16:12

Apply suggestions from code review

318259b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

make sure that an application belongs to a tenant

18d2609

mooreds requested a review from Copilot April 7, 2026 22:16

Copilot started reviewing on behalf of mooreds April 7, 2026 22:16 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

mooreds and others added 6 commits April 17, 2026 09:23

Merge branch 'main' into mooreds/add-oauth-2-1-check

3f405fd

Apply suggestion from @Copilot

f249ced

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'mooreds/add-oauth-2-1-check' of github.com:FusionAuth/f…

3d03abf

…usionauth-node-cli into mooreds/add-oauth-2-1-check

updated dpop reference

6fc7dca

updated the limitations to reflect reality

ee24980

limit checks to the containing tenant if the application id is provided

afd9a53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add oauth 2.1 check#37

Add oauth 2.1 check#37
mooreds wants to merge 19 commits intomainfrom
mooreds/add-oauth-2-1-check

mooreds commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	- DPoP (sender-constrained tokens) enabled on applications (§1.4.3)
	- DPoP (sender-constrained tokens) available on the FusionAuth instance / Enterprise-enabled (§1.4.3)


		// -- Instance-level checks -------------------------------------------

		const dpopResult = checkDpop(dpopFeatureActive ?? false);

	&& typeof response === 'object'
	&& typeof response === 'object'
	&& 'response' in response

Conversation

mooreds commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants